What is the CVSS score of EUVD-2026-41273?

EUVD-2026-41273 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.4%.

Contact Form Entries EUVD-2026-41273

| CVE-2026-9145 MEDIUM

Path Traversal (CWE-22)

2026-07-02 Wordfence

GHSA-hhr7-mvm5-p73g

PHP WordPress Path Traversal Database For Contact Form 7 Wpforms Elementor Forms Wordpress Plugin Crmperks

6.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.5 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

6.5 MEDIUM

AC:H reflects mandatory Elementor Pro co-dependency; PR:N confirmed unauthenticated; C:H for arbitrary server file read; I:L for blind file copy with no direct write control.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 10:22 vuln.today

CVE Published

Jul 02, 2026 - 09:32 cve.org

MEDIUM 6.5

DescriptionCVE.org

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Arbitrary File Copy via the create_entry_el() function in versions up to, and including, 1.5.1. The function reads raw_value from Elementor Pro's Form_Record object for upload-type fields and passes it directly to PHP's copy() without validating that the value corresponds to a legitimately uploaded file - when no file is present in $_FILES, raw_value reflects the attacker-controlled POST string. copy() accepts both local filesystem paths and URL sources, so the attacker can target any file readable by the PHP process or supply an attacker-controlled remote URL. Elementor Pro is a prerequisite for triggering the code path (it owns the elementor_pro/forms/new_record hook and populates the Form_Record object), but the bug itself is entirely in Contact Form Entries' handler. This could allow unauthenticated attackers to disclose arbitrary files on the affected site's server. The file is copied to a directory unknown to the attacker; the hashed directory name provides defense-in-depth but is generated from non-cryptographic sources (uniqid() + rand()) and should not be relied upon as the primary mitigation.

AnalysisAI

Arbitrary file copy in the Database for Contact Form 7, WPforms, Elementor Forms WordPress plugin (versions ≤ 1.5.1) exposes any file readable by the PHP process to unauthenticated network attackers. The create_entry_el() function accepts attacker-controlled POST data as a file path and passes it directly to PHP's copy(), which transparently accepts both local filesystem paths and remote URLs - enabling server file exfiltration or remote resource staging. Exploitation requires Elementor Pro to be installed and active alongside the vulnerable plugin; no public exploit or CISA KEV listing has been identified at time of analysis, though the unauthenticated network vector and high confidentiality impact make this a credible priority for mixed Elementor Pro deployments.

Technical ContextAI

The affected plugin (CPE: cpe:2.3:a:crmperks:database_for_contact_form_7,_wpforms,_elementor_forms) hooks into Elementor Pro's elementor_pro/forms/new_record action to persist form submissions. Within create_entry_el(), the code retrieves raw_value from Elementor Pro's Form_Record object for upload-type fields. Normally this would reflect a server-side temporary file path, but when no file is present in $_FILES the function falls through to using the attacker-controlled POST string directly. This value is passed without path validation or allow-list checking to PHP's built-in copy(src, dst) - a CWE-22 (Path Traversal) root cause. PHP's copy() natively resolves both absolute filesystem paths (e.g., /etc/passwd, wp-config.php) and http:// / https:// URLs via stream wrappers, compounding the risk. The destination is a directory named with uniqid() + rand(), which the description explicitly flags as non-cryptographic and unsuitable as a primary control.

RemediationAI

No patched version has been independently confirmed from the available data - the only Trac references point to the vulnerable 1.5.1 tag, and no changelog entry or newer release tag is cited in the references. Site administrators should consult the WordPress plugin directory and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/2ccadf7c-b628-43b6-a6b0-828ca31ff9cc) to determine whether a patched release has been published since this report. As an immediate compensating control, deactivating the Contact Form Entries plugin entirely removes the vulnerable hook handler with no impact on Elementor Pro itself, though it will disable form submission logging. Alternatively, removing or disabling upload-type fields from all Elementor Pro forms prevents the attacker-influenced raw_value from being populated, at the cost of losing file upload functionality in those forms. Web application firewall rules that block POST requests containing absolute path strings (e.g., patterns matching ../../, /etc/, wp-config) to form submission endpoints can reduce automated exploitation risk but are bypassable with creative path encoding. Do not rely on the hashed destination directory as a mitigation; it is generated from uniqid() + rand(), which are non-cryptographic and potentially predictable under timing side-channels.